ffd00946ac826583c1df3a1e655bad9e0780f06cb5acd72b3ad8d0b47b9945ae | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ffd00946ac826583c1df3a1e655bad9e0780f06cb5acd72b3ad8d0b47b9945ae
Size

666KB
Sample

240920-3xywdavfpe
MD5

c6adaa326a72ef771c194d22dd0394fe
SHA1

3ba981502e358028543c221992113fe5881ba436
SHA256

ffd00946ac826583c1df3a1e655bad9e0780f06cb5acd72b3ad8d0b47b9945ae
SHA512

3b37d695c4daf156acfbd6e5519140e4589d61ee839c802309eca67c1acd5b6c5c960d1e55ec6953a71add7dde687917bf4991b4d935f8fc960f4c654cf56b42
SSDEEP

12288:D1UaJQyAwT5l0lVvqaBnfxAlpH9eJX51qz9LqJPQhYsJHa5qmKLijiJ0:BGSTKq8npul9kp1e9WuWf5fJO0

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  ffd00946ac826583c1df3a1e655bad9e0780f06cb5acd72b3ad8d0b47b9945ae
- Size
  
  666KB
- MD5
  
  c6adaa326a72ef771c194d22dd0394fe
- SHA1
  
  3ba981502e358028543c221992113fe5881ba436
- SHA256
  
  ffd00946ac826583c1df3a1e655bad9e0780f06cb5acd72b3ad8d0b47b9945ae
- SHA512
  
  3b37d695c4daf156acfbd6e5519140e4589d61ee839c802309eca67c1acd5b6c5c960d1e55ec6953a71add7dde687917bf4991b4d935f8fc960f4c654cf56b42
- SSDEEP
  
  12288:D1UaJQyAwT5l0lVvqaBnfxAlpH9eJX51qz9LqJPQhYsJHa5qmKLijiJ0:BGSTKq8npul9kp1e9WuWf5fJO0
Score

8^/10

discovery persistence
- Adds policy Run key to start application
  persistence
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence